PHP session storage
Change session.save_path only when the application requires a writable, private session directory
Most hosted applications should use the working Plesk default. A custom path can solve a documented application or isolation requirement, but it must exist, belong to the correct subscription and stay outside publicly downloadable web content.
When is a custom session path appropriate?
Documented application need
The software vendor explicitly requires file-based sessions in a particular writable location.
Broken default path
Logs show that PHP cannot create session files and the current path or ownership is genuinely invalid.
Deliberate isolation
A developer needs a private per-subscription location and understands cleanup and permissions.
Not a general speed tweak
Changing the path does not automatically improve performance and can break authentication if configured incorrectly.
Set session.save_path for one domain in Plesk
- 1Record the current value
Check PHP Settings or a temporary diagnostic page, then remove that diagnostic page after use.
- 2Create a private directory
Place it within the subscription’s private area, not in a public web directory, and apply restrictive ownership.
- 3Open PHP Settings
Select the domain in Plesk and add the required session.save_path value at domain scope.
- 4Apply and test
Confirm the effective value, then test login, baskets, forms and any other session-dependent workflow.
What to check if sessions still fail
| Check | Why |
|---|---|
| Directory exists | PHP cannot write into a missing path |
| Ownership and permissions | The domain’s PHP handler needs controlled write access |
| Disk space and inode use | A full filesystem can prevent session creation |
| Effective PHP handler | CLI and website PHP can load different configuration |
| Session cleanup | Old files should expire without deleting active sessions too aggressively |
PHP session questions
Can I change session.save_path in .htaccess?
That depends on the PHP handler and may be ignored or cause an error. Use the domain’s Plesk PHP Settings for a predictable scoped change.
Should the directory be inside httpdocs?
No. Session files can contain sensitive state and should be kept outside publicly served content.
Why does php -i show a different value?
Command-line PHP can use a different configuration from the website handler. Verify through the domain’s effective PHP configuration.
Change only with a reason
Keep session storage private, scoped and testable
Record the old value so you can reverse the change if the application behaves differently.